CVE-2022-4900

Overview

PHP is a general-purpose scripting language used mostly for web development. It runs behind web servers through server APIs such as Apache mod_php and PHP-FPM, and powers content management systems and frameworks such as WordPress, Drupal, Moodle and Laravel. Its command-line binary includes a built-in web server for development, started with php -S, which since PHP 7.4 can run several worker processes when the PHP_CLI_SERVER_WORKERS environment variable is set.

A Buffer Overflow vulnerability (CVE-2022-4900) has been identified in the worker start-up code of PHP's CLI built-in web server, which allows whoever starts the server with a very large PHP_CLI_SERVER_WORKERS value to trigger a heap buffer overflow, according to the CVE record, and crash the server. PHP tracks this issue as GH-8989.

Per MITRE CWE-119: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

This issue affects PHP 7.4, including the End-of-Life release line through its final release, 7.4.33, PHP 8.0 before 8.0.22 and PHP 8.1 before 8.1.9.

Details

Module Info

• Product: PHP
• Affected packages: php-src (sapi/cli)
• Affected versions: >=7.4.0 <8.0.22, >=8.1.0 <8.1.9
• GitHub repository: https://github.com/php/php-src
• Published packages: https://www.php.net/downloads
• Package manager: N/A
• Fixed in:
  • OSS PHP 8.0.22, 8.1.9
  • NES for PHP 7.4.1 (based on PHP 7.4.33)

Vulnerability Info

This Medium-severity vulnerability is found in the CLI built-in web server of PHP 7.4, PHP 8.0 before 8.0.22 and PHP 8.1 before 8.1.9. No upstream PHP 7.4 release carries the fix, so the End-of-Life PHP 7.4 line is affected through 7.4.33. Red Hat, the CNA, scores it 6.2 under CVSS 3.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and describes a heap buffer overflow when the environment variable is set to a large value.

When PHP_CLI_SERVER_WORKERS is set, the server reads the number of workers from it, allocates an array to hold one process ID per worker, and forks the workers. In PHP 7.4.33 the code reads:

ZEND_ATOL(php_cli_server_workers_max, workers);

if (php_cli_server_workers_max > 1) {
    zend_long php_cli_server_worker;

    php_cli_server_workers = calloc(
        php_cli_server_workers_max, sizeof(pid_t));
    if (!php_cli_server_workers) {
        php_cli_server_workers_max = 1;

        return SUCCESS;
    }

Nothing bounds the number of workers, and the array is sized directly from it with the system calloc(). The upstream fix describes the change as preventing a potential buffer overflow for large values of the worker count. The process IDs are then written into the array as workers start, and the array is read again at shutdown.

Only the CLI built-in server (php -S) contains this code, and only when it is started with PHP_CLI_SERVER_WORKERS set. The variable is set by whoever starts the server, which is why the CVSS vector is local. The built-in server is meant for development; php-fpm, the Apache module and the other SAPIs do not contain this code and are not exposed.

The fix allocates the array with PHP's own persistent allocator, pecalloc(), and frees it with pefree(). A worker count whose array size overflows now stops the server with the fatal error "Possible integer overflow in memory allocation", and a failed allocation stops it with an out-of-memory error. In the upstream code the allocation reads:

php_cli_server_workers = pecalloc(
    php_cli_server_workers_max, sizeof(pid_t), 1);

Mitigation

The PHP project publishes security fixes only for its supported release lines. PHP 7.4 is End-of-Life and will not receive any public updates to address this issue.

Until an upgrade is possible, do not use the built-in web server outside development, and do not start it with an untrusted or unusually large PHP_CLI_SERVER_WORKERS value.

Users of the affected components should apply one of the following mitigations:

• Upgrade to PHP 8.0.22, 8.1.9, or later.
• Leverage a commercial support partner like HeroDevs (NES for PHP) for post-EOL security support.

Credits

• guoyiyuan (remediation)